Recently active topics

Known issue page(s) updated: CRIBL-31266 | Metrics with `_metric` and `_value` fields are merged into a single key-value pair CRIBL-45815 | JSON Array Event Breaker pegs Worker CPU and drops records when a JSON field exceeds 8 MB

SymptomIn the Event Breaker Ruleset rule editor, the Out tab renders an empty table for pasted or uploaded sample data. No events, no error, and no warning appear, so the rule looks broken even though it breaks events correctly on live data.The behavior occurs when the rule's Filter condition references a metadata field rather than _raw. For example:sourcetype == 'postgresql:uf'__collectible.collectorId == 'my_collector_id'Setting the Filter condition to true makes the expected broken events appear immediately in the Out tab.EnvironmentCribl Stream 4.19.2 Cribl.Cloud and self-managed. Component: Processing > Knowledge > Event Breaker Rulesets rule editor preview. Affects all Event Breaker types, including Regex and JSON Array.ResolutionThe Event Breaker itself is working. This is a preview limitation, not a rule defect. Verify the breaker logic with a temporary filter, then restore the original expression.Open Processing > Knowledge > Event Breaker Rulesets and select the r

SymptomCribl Stream Worker Processes consume most or all available memory after Suppress functions are enabled or their cache settings increase. Worker Processes restart, become unresponsive, or worker nodes become unavailable after memory pressure or an operating-system out-of-memory event.EnvironmentCribl Stream Pipeline Suppress functions Distributed deployment with multiple Worker ProcessesResolution Review each Suppress function’s filter, key expression, suppression period, cache size limit, and cleanup settings. Estimate the distinct key count for each key expression during one suppression period. Identify high-cardinality keys, such as source or destination fields with many unique values. Reduce the key cardinality when the suppression requirement allows it. Keep the default cache size limit unless required Increase the cache size incrementally in a controlled test when a larger cache is required. Disable duplicate Suppress functions that run simult

This article explains how to send OTLP data over HTTP to the Cribl OpenTelemetry Source using curl, how this differs from OpenTelemetry exporters, and how to troubleshoot common errors. It focuses on logs, but the same patterns apply to metrics and traces. OTLP HTTP vs gRPC: Endpoints and Ports Content-Type and Payload Encoding How OTel Exporters Behave vs Using curl Manually for Testing Example: Sending OTLP Logs over HTTP with curl Adding HTTPS and Authorization Troubleshooting Common HTTP OTLP Issues 501 errors: Unsupported Content-Type 400 errors: OTLP version and path mismatch TLDR; Quick Checklist OTLP HTTP vs gRPC: Endpoints and PortsThe OpenTelemetry protocol defines different conventions for HTTP and gRPC transports:HTTP OTLP Default OTLP HTTP port: 4318. You must POST to per-signal endpoints: /v1/logs /v1/metrics /v1/traces Example base URL, port, and path: http://<cribl_host>:4318/v1/logs gRPC OTLP Default OTLP gRPC port: 4317. No URL path is used (rou

I have an issue where my cloud worker nodes were unable to send data to my S3 buckets and as a result, the data backed up. The issue with the connection to S3 appears to be resolved but the nodes are still errored out:Error: Unable to write to the filesystem, disk space is low.#secondsThrottled:1.188#throttledCount:2αthrottledFirstSeen:2026-09-25T00:47:16.159ZαthrottledLatestSeen:2026-09-25T00:47:17.347Z

Known issue page(s) updated: CRIBL-45815 | JSON Array Event Breaker pegs Worker CPU and drops records when a JSON field exceeds 8 MB

New known issue page(s) added: CRIBL-45815 | JSON Array Event Breaker pegs Worker CPU and drops records after malformed input

Scaling a Cribl.Cloud deployment - To workspace or not to workspace? When growing a Cribl deployment you may encounter a situation where some new people need to use Cribl. This can arise from new business units engaging, new subsidiaries or an international expansion. At this point, the current team needs to decide how to support this. Would a new workspace be best or would a dedicated Stream Worker Group/Cribl Edge Fleet be sufficient? In this article, I’ll explain the trade offs involved in each choice and when one might be best for you. Cribl.Cloud WorkspacesA Cribl.Cloud Organization consists of one or more Workspaces. Each Cribl.Cloud Workspace has its own isolated components and logical groups. The Leader nodes are different, the ingestion points are different, the compute resources are different, the Cribl products are different and the access permissions are different. In fact, Workspaces are so different, there’s only a few common Organization settings to consider. The commona

New known issue page(s) added: CRIBL-45661 | WEF Kerberos authentication fails for mixed-case keytab principals

New known issue page(s) added: AI-5162 | Custom AI provider connections to Azure OpenAI models fail

SymptomWhen importing a Pack from an Azure DevOps Git repository, Cribl Stream fails with:failed to install: Invalid or unsafe URL/IP address: URL has forbidden patterns.This occurs when the Azure DevOps project name contains spaces and the URL encodes them as %20.EnvironmentCribl Stream Pack import from Git Azure DevOps Git repository with spaces in the project nameResolutionNavigate to the Azure DevOps project. Navigate to Project settings > Overview. Copy the project ID (GUID). Replace the project-name path segment in the repository URL with <project-guid>. Navigate to the affected Worker Group's Packs page in Cribl Stream. Select Add Pack. Select Import from Git. Enter the updated repository URL. Select Import. Verify that the Pack imports successfully.Note: Preserve the repository's existing organization, repository, branch, and authentication details when updating the project path.CauseThis can be caused by an Azure DevOps project name containing spaces, which appear as

SymptomAn Azure Blob Storage Collector job discovers the target blob but extracts zero events from it. The following conditions are all present:Discovery succeeds — the target blob appears in the Collector's discovery results. Blob content reads succeed with no network, DNS, or authentication errors. clientSecret authentication with the Storage Blob Data Contributor role is sufficient for both list and read operations. Swapping the job's pipeline to passthru makes no difference. The event count is still zero. No error or warning appears anywhere, not in Job Inspector and not in the worker cribl.log at any log level. The task reports success with zero events. The source file, when opened in a text editor or viewed in the Azure Portal, clearly contains valid JSON data.EnvironmentCribl Stream (Cloud-managed or self-managed). Not version-specific — applies to any release using the json_array Event Breaker type, or a built-in pipeline with equivalent array-detection logic (for example, azur

SymptomCribl Stream ingests UDP data on one network interface but not another, even though packets arrive on both interfaces and the Source listens on 0.0.0.0.EnvironmentCribl Stream self-managed Worker on Linux UDP or Raw UDP Source Worker with multiple network interfaces Source Address configured as 0.0.0.0ResolutionIdentify the network interfaces that receive the UDP traffic.ip -br address Verify the reverse-path filtering value for each affected interface.sysctl net.ipv4.conf.<interface>.rp_filter Disable reverse-path filtering on each affected interface.sudo sysctl -w net.ipv4.conf.<interface>.rp_filter=0 Repeat the configuration for every affected interface. Send test UDP data to each interface IP address. Verify that Cribl Stream ingests the test data from each interface. Persist the interface-specific setting in the host’s system configuration if it must survive a restart.CauseThis can be caused by:Linux reverse-path filtering in strict mode (rp_filter=1) rejecting

SymptomLogs appear delayed due to _timestamp not matching expected log time according to date/time values in _raw. Instead of expected date/time and epoch timestamp within _raw is picked up. For example: 2026-03-12,18:23:48 (comma is the issue).EnvironmentCribl StreamResolutionTo resolve this issue, you have three options:Create a custom timestamp regex in a custom breaker to extract the correct values and apply that to the source (if available). Create a pipeline eval function to replace the auto-extracted _timestamp with the correct values. Modify the log output at the sender to combine date/time into an accepted value.CauseThis issue occurs because the format of log date/time does not match the auto-matched formats as defined in cribl/src/sluice/js/public/Time.ts. If the correct timestamp isn’t matched but a matching timestamp format is found later in the event, that will get picked up instead.const DATES = [  '%Y-%m-%d',   // 2018-12-26  '%Y/%m/%d',   // 2018/12/26  '%m-%d-%Y',   /

SymptomWhen the AWS ADOT Lambda distro exports histogram metrics, its default aggregation can produce ExponentialHistogram payloads. Cribl Stream logs got an unsupported metric type; these metrics are rejected and do not reach downstream Destinations.EnvironmentCribl Stream OpenTelemetry Source receiving OTLP metrics. AWS ADOT Lambda distro exporting histogram metrics. Histogram aggregation set to ExponentialHistogram by the sender default.ResolutionReview the OpenTelemetry Source logs for got an unsupported metric type and record the affected metric names. Verify that the affected metrics originate from an AWS ADOT Lambda distro. Configure the Lambda function to use explicit-bucket histogram aggregation instead of ExponentialHistogram aggregation. Set the OTEL_EXPORTER_OTLP_METRICS_DEFAULT_HISTOGRAM_AGGREGATION environment variable to this value:explicit_bucket_histogram Redeploy or restart the upstream sender. Verify that the OpenTelemetry Source no longer logs the unsupported metric

New known issue page(s) added: CRIBL-45486 | Prometheus Scraper Source fails on Workers older than the Leader

New known issue page(s) added: CRIBL-45467 | Event Breaker Function discards Pipeline events on Nodes older than the Leader CRIBL-45484 | Parser Function with Auto-Parse skips events on Nodes older than the Leader

Known issue page(s) updated: CRIBL-45296 | Outpost TLS distributed setting failing on validation due to presence of lakeAzure entry in the payload CRIBL-45304 | Microsoft Sentinel Destinations fail to authenticate with Microsoft CRIBL-45369 | Worker Process memory leaks while Collection jobs run

New known issue page(s) added: SEARCH-15551 | Exporting to a lookup reports a failed job when the query uses two reset-emitting operators

**Environment:**- Cribl Version: 4.18.1- Leader: AWS eu-west-1, behind internal NLB (port 4200)- Outpost: On-prem Linux server Background: We are deploying Cribl Edge nodes on-prem. The generated bootstrap script points to the Outpost server on port 9000 (default). When we run the script as-is, the `/init/cribl-edge` endpoint returns an HTML page (the Cribl Web UI) instead of a shell script:But when we modified the bootstrap script to use port 4200 instead of 9000, pointing to the same Outpost server. With port 4200, the `/init/cribl-edge` endpoint returns the correct shell script, the Edge node installs successfully, and it connects and reports to the Leader as expected.Question:Is it expected/by design that the Edge bootstrap endpoint `/init/cribl-edge` only works on port 4200 (the distributed communications port) and not port 9000 (the web UI/API port) on an Outpost server?The default generated bootstrap script uses port 9000. Is this a bug in the script generation, a misconfigurati

New known issue page(s) added: CRIBL-45432 | Cannot create or rename Route or Function groups

Known issue page(s) updated: CRIBL-45369 | Worker Process memory leaks while Collection jobs run

QuestionWhy does Members & Teams show the Admin role for users that I've granted the Owner role via group membership in my SSO IDP?Environment Cribl environment with SSO configured for login AnswerFor SSO users, the role in the Cribl UI is updated when a user signs in and it reflects the role granted the last time they signed in. Therefore, the Cribl UI may not always align with the SSO IDP. The IDP is the source of truth for current permissions for SSO users.

ObjectiveWrite an initial Getting Data In (GDI) datatype rule filter in Cribl Search Lakehouse using the correct available fields.EnvironmentCribl Search 4.17.0 (Lakehouse engines) Search > Data > Getting Data In Initial Datatype / Dataset rule KQL expression fieldProcedure Identify which fields are available at the initial GDI rule stage. Only a small set of metadata exists at this point, before any parsing or time extraction has occurred: _raw -- full raw event string as received from the source __inputId -- ID or name of the GDI source that ingested the event port -- destination TCP/UDP port of the source host -- source host (IP or FQDN) that sent the data Write the filter expression using only the fields listed above. Do not reference fields that are created after parsing or later in the pipeline, such as type, action, source_ip, dest_ip, datatype, _time, or schema. Conditions that reference those fields will not match because they do not yet exist when t

New known issue page(s) added: CRIBL-45369 | Worker Process memory leaks while Collection jobs run